Device-Independent Randomness Generation in the Presence of Weak Cross- Talk 
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Device-independent protocols use nonlocality to certify that they are performing 
properly. This is achieved via Bell experiments on entangled quantum systems, which 
are kept isolated from one another during the measurements. However, with present- 
day technology, perfect isolation comes at the price of experimental complexity and 
extremely low data rates. Here we argue that for device-independent randomness gen- 
eration — and other device-independent protocols where the devices are in the same lab 
— we can slightly relax the requirement of perfect isolation, and still retain most of the 
advantages of the device-independent approach, by allowing a little cross-talk between 
the devices. This opens up the possibility of using existent experimental systems with 
high data rates, such as Josephson phase qubits on the same chip, thereby bringing 
device-independent randomness generation much closer to practical application. 



Introduction The great advantage of device- 
independent (DI) protocols is their reliance on a small 
set of tests, which are nevertheless sufficient to certify 
that they are performing properly. This is achieved by 
carrying out nonlocality tests on entangled quantum sys- 
tems. In particular, no assumptions are made regarding 
the inner workings of the devices, such as the Hilbert 
space dimension of the underlying quantum systems, etc. 
[l], Q. Each device is treated as a 'black box' with 
knobs and registers for selecting and displaying (classi- 
cal) inputs and outputs. Applications include quantum 
key-distribution 0-Q , coin flipping @ , state tomography 
lioj , genuine multi-partite entanglement detection 
llf7 self-testing of quantum computer s fl2l . [l3j , as well 
as DI randomness generation (RG) [l4l - |l8j |. 

It is often remarked that DI cryptographic protocols 
remain secure even if the devices have been provided, or 
sabotaged, by an adversary. This scenario, while concep- 
tually fascinating, is of little (if any) practical relevance. 
This is because (i) there are many types of attacks avail- 
able to a malicious provider - the majority being classical 
- that eliminating them all is an enormous task; (ii) in 
any case we assume the existence of honest providers of 
e.g. the source of randomness, the jamming technology 
to prevent information leakage from the labs, or the clas- 
sical devices used to process the data. A scenario where 
one can trust the latter, but an honest provider for the 
quantum devices cannot be found, is highly implausible. 

The actual advantage of DI protocols is that they allow 
us to monitor the performance of the devices irrespec- 
tively of noise, imperfections, lack of knowledge regard- 
ing their inner workings, or limited control over them. 
Indeed, even if the devices were obtained from a trusted 
provider and thoroughly inspected, many things can still 
unintentionally go wrong (as demonstrated by the at- 
tacks on commercial quantum key-distribution systems 
[r^ - |2lj . which exploited unintentional design flaws). 

This problem is particularly acute in the case of DI RG, 
as it is very difficult even for honest parties to maufac- 
ture reliable randomness generators (whether classical or 
quantum) and monitor them for malfunction. The gen- 
eration of randomness in a DI manner solves many of the 



shortcomings of customary RG protocols, since, as men- 
tioned above, the degree of violation of a Bell inequality 
provides an accurate estimate of the amount of random- 
ness generated irrespectively of experimental imperfec- 
tions and lack of control. DI RG has so far been proven 
secure against adversaries with classical side-information 
about the devices (which is the relevant case when the 
provider is trusted) for arbitrary Bell inequalities and de- 
grees of violation [l6|, Oj} , and against adversaries with 
quantum side-information in the case of very high viola- 
tion of the CHSH inequality 

Unfortunately, DI RG is experimentally highly chal- 
lenging. It requires a Bell experiment with the detection 
loophole closed and with the quantum systems isolated 
from one another. 

A proof of principle experiment was reported in (TBj 
using two ions in separate vacuum traps, but this system 
operates at an extremely low rate (~ 1 mHz), precluding 
any practical application. Nevertheless, there exist today 
experiments involving, for example, two Josephson phase 
qubits on the same chip coupled by a radio frequency res- 
onator [22| , or two ions in the same trap coupled via their 
vibrational modes 0, [24[ , which allow for Bell violating 
experiments (with the detection loophole closed) at much 
higher data rates (> 1 kHz). 

In these experiments the quantum systems are very 
close to one another. This proximity provides the non- 
negligible coupling required for high entanglement gen- 
eration rates. Adapting DI RG to these types of experi- 
ments would bring it much closer to real-life application. 
The problem is that precisely because the systems are 
close to one another and non- negligibly coupled, they 
can no longer be considered as completely isolated (see 
[2f| and [26| for a discussion of the couplings involved). 
The aim of the present work is to show how to take this 
coupling into account by relaxing slightly the assump- 
tions behind the DI approach, while keeping as much as 
possible all of its advantages. 

We begin by showing how to derive bounds on the 
RG rate in a DI setting given a known amount of cross- 
talk (CT). Next, we present methods for estimating the 
amount of CT present in an experiment. Our approach is 



2 



then illustrated on Josephson phase qubits, showing that 
efficient DI RG is possible using already established tech- 
nology. We start first, however, by recalling briefly the 
essential ingredients of DI RG relevant to our analysis. 
We refer to [IB - [l7| for a more detailed presentation. 

Bell inequalities and device-independent randomness 
generation - A Bell experiment is characterized by 
the probabilities V = {P a b\xy} of obtaining the out- 
comes (or outputs) a and b given the measurement set- 
tings (or inputs) x and y. A Bell expression T{P) = 
Sabxy c abxyP a b\xy is a linear function of these probabil- 
ities. For instance, the CHSH inequality has the form 

*V>) = E a , hx , v e {0 ,i}(-l) a(Bb ® Xl 'Pab\ xv < 2. To any 
Bell expression, one can associate a bound on the ran- 
domness of the outputs given the inputs x and y through 
a function P* (I) such that max a & PM xy < Pty (-0 
holds for any V for which X (P) = I [l|-0jj. The function 
P* y {I) should be monotonically decreasing and concave 
in / (if not we can take its concave hull). Higher val- 
ues of P*(I) imply less randomness, in particular when 
mhi Xj y P* y (I) — 1 the system is fully deterministic. 

Given knowledge of such a function and the degree 
of Bell violation / observed in an experiment where the 
devices are used n times in succession, one can infer a 
lower bound on the min-entropy of the measurement out- 
comes. By applying a randomness extractor to the result- 
ing string of outcomes, one then obtains a new private 
string of random numbers of length ~ — n log 2 P* y (I) 
which is arbitrarily close (up to a security parameter) 
to the uniform distribution. Depending on the assump- 
tions made regarding the devices and the adversary, such 
a protocol may also require an initial random seed (in 
which case one talks about DI randomness expansion) 
that may be polynomially [l5[ or exponentially [ljl OjJ 
smaller than the output string. 

Device-independent randomness generation with weak 
cross-talk - In the security analysis of DI RG protocols 
the assumption that the two Bell violating devices are 
isolated from one another only appears in the derivation 
of the bound P* (I) > max a h P a b\xy If we introduce a 
similar bound P* y (/, x) that is valid in the presence of a 
given amount of CT \ (defined below), then the rest of 
the reasoning of [15l4l7l | will apply without modification. 

To define such a CT-dependent bound, we write the 
probabilities observed in a Bell experiment as P a b\xy — 
Tr (pTL a b\xy) , where p € Ha ® H B and {U ab \ xy } is a 
POVM on H A 8 H B (i.e. U ab \ xy h and Eab n ab\xy = 
1). The novelty with respect to the standard mathe- 
matical description of Bell experiments is in allowing the 
measurement Tl a b\xy to act collectively on the two sys- 
tems. We will say that such a collective measurement 
requires no more than \ amount of CT if there exists a 
product POVM <g) n^} satisfying 

- xi =< n a b\xy - n a | x ® n % ^ xi (!) 

for all combinations of a and b. This condition restricts 
how far each collective POVM may be from a product of 
two independent POVMs. In particular, when x = the 
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FIG. 1: DI upper bounds on P * . The middle (top) curve 
gives an SDP based upper bound obtained from Eq. {2} (Eq. 
©), as a function of the CHSH violation I, given \ ~ 0.01. 
The bottom curve bounds Pg when x = 0. 

H a b\xy can be expressed as products, while when x = 1 
they are unconstrained. 

Consider now a fixed value of x and a Bell violation 
/. Then the solution of the following program provides 
the minimal amount of randomness P* y (/, \) compatible 
with / and 

p L(I>x) = max max P a b\x y (2) 

a,b Q 

S-t. Pab\xy = Tr (pll ab \ xy ) , T(V) = I, 
-%1 d Hab\xy - n a|x 8> n fc | y ^ X 1 , 

where the optimization runs over the set Q — 
{p, {R a \x}, {n fc | y }, {tt a b\xy}, H B } specifying the 
state, measurements, and the Hilbert spaces. This formu- 
lation is therefore DI in spirit, since the bound is formu- 
lated without fixing the dimension of the Hilbert spaces, 
nor how the measurements are implemented, etc. 

Upper bounds on the optimization problem Eq. @ 
can be obtained using the techniques of [28, 29], which re- 
lax the problem to a hierarchy of semi-definite programs 
(SDPs). In particular, the resulting series of bounds is 
guaranteed to converge to the true solution. Neverthe- 
less, depending on the problem, even the lowest order 
relaxation may be computationally intractable. We may 
then obtain a weaker bound in terms of P* y (I, 0) - the 
solution in the absence of CT. Let p', {n^ }, {n^}, and 
{n^i } be the state and POVMs corresponding to the 
solution of Eq. ©, and let P' ab]xy = Tr^TP^n^) and 
V' = {Pab\ xy }- F rom the last constraint in Eq. @ we 
have that \Plb\xy-PU\xy\ ^ X, andsoX(7") > l(P)-j X 
where 7 = J2 a ,b,x,y \ c abxy\ (in the case of the CHSH in- 
equality for instance 7 = 16). Taken together, the last 
two inequalities imply that 

p: y (i, X )<p: y (i-ix,o)+x- (3) 

Fig. 1 displays upper bounds on -P *q obtained from Eq. 
@ and Eq. (J3J) in the case of the CHSH inequality. 
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Finally, we note that the last constraint in Eq. ([2]) 
implies that the signaling - the extent to which the out- 
put of one device depends on the input of the other - 
is constrained. Specifically, if to each input x and each 
input y correspond N outputs, iPoi^ — Palsy' I fs 27V x 
for all a, x, y, y' , etc. (in the case of zero signaling, one 
has P a \xy — Pa\xy')- This allows us to derive a simpler 
bound on P* y , depending solely on the amount of signal- 
ing present, in contrast to the bounds Eqs. J2]) and ([3]), 
which rely on the full structure of quantum mechanics. 
To this end we define the maximal amount of signaling 
allowed as 

5 = max! max |P i xy -P a \ xy >\ , max \P b \ xy -P b \ x > y \ \ . 

Ka,x,y,y' b,y,x,x' J 

When 6 = 0, V resides within the no-signaling polytope 
while when 6 > V resides within a larger, higher- 
dimensional polytope. The bound can be obtained by 
solving the linear program P xy (I, S) — max a f, P a b\xy, 
given that I(P) = I, \P a \ xy ~ P a \xy'\ < 8, and \P b \ xy - 
Pb\x'y \ < 5. In the case of the CHSH inequality, one can 
show that (see Appendix A) 

P: y {I,6)<\-\l + 25. (5) 

This bound applies to any post-quantum theory which 
restricts the amount of signaling (as well as to quantum 
mechanics). 

Estimating the amount of cross-talk - We have just 
seen how the introduction of a new security parameter 
X, quantifying the amount of CT between the devices, 
allows us to extend the scope of DI RG to settings with a 
limited amount of CT. To apply this approach, we there- 
fore need a reliable prior estimate of Xj an d means of 
guaranteeing or verifying that the CT will not exceed this 
estimate during latter operations of the devices. This 
obviously requires some modeling of the devices' inner 
workings. Indeed, it is impossible to upper-bound the 
amount of CT from first principles only or from any set 
of observed data V alone, since communicating devices 
can deterministically reproduce any V, and therefore sim- 
ulate any degree of Bell violation. 

At first, this may seem an unwelcome departure from 
the purely DI approach (i.e. x — 0). Nevertheless, our 
approach has the advantage over fully device-dependent 
approaches that only a single parameter \ must be 
device- dependently estimated to ensure that the protocol 
performs properly, and this same parameter is used ir- 
respectively of the underlying physical realization. Mor- 
ever, even in purely DI protocols the absence of commu- 
nication cannot be deduced from the observed data alone, 
and to verify that there is indeed no-communication will 
necessarily involve putting our trust in certain general 
assumptions regarding the behavior of the devices, or 
relying on some trusted external hardware. Seen in this 
light, our approach is not very different from the standard 
(DI) one, except that instead of verifying in some trusted 
way that \ = 0, we must verify that x 1S n0 greater than 



some finite value. Finally, we note that our approach 
allows as a safeguard to set x to be greater than its ex- 
pected value - a feature that may be useful even in for 
purely DI protocols with (allegedly) non-communicating 
devices. 

Even though a maximal amount of CT x cannot be 
guaranteed without some modeling of the devices, there 
are several ways to lower-bound x from the observed data 
V only. If the devices were not fabricated by an adversary 
and do not act maliciously, then these lower bounds may 
provide good estimates of x- 

A simple way to lower-bound x in a DI manner is via 
the degree of violation of the no-signaling conditions Eq. 
dU, computed from the observed data V. From Eq. 
it follows that x > S/2N. Improved DI bounds are ob- 
tainable, however, reflecting the fact that 8 does not cap- 
ture all of the information contained in V. The minimal 
amount of CT that is compatible with a given V is given 
by the solution of the following optimization problem 

nun x (6) 

S.t. Tr {jp^ a b\xy) — Pab\xyi 
-%1 ^ Hab\xy ~ n o | a <g> Ilb\y ^ 

which can be lower-bounded using the techniques of 
[28l [29j . It is clear that this bound is optimal, since 
the optimization runs over all possible states p and sets 
of projectors {IL^}, {n b | y } and {IL ab \ xy } satisfying the 
constraints in Eq. @. That it constitutes an improve- 
ment over the bound provided by Eq. is seen by 
considering the case of post-quantum non-signaling dis- 
tributions (including those that do not violate Tsirelson's 
bound pSljl). Such distributions will not give rise to a non- 
vanishing bound via Eq. However, since they cannot 
be realized quantumly without communication, they will 
give rise to a non- vanishing bound via Eq. ([6]). See Fig. 
2. 

It is possible of course that the true value of x is not re- 
vealed by the above lower bounds (for instance, points in 
QR in Fig. 2 can be reproduced either with or without 
CT and thus the real value of x cannot be unambigu- 
ously determined from the observed data V alone) . Nev- 
ertheless, one can also adopt a more device-dependent 
approach to estimating %. In particular, if the lower 
bound provided by Eq. ^ equals zero, one can vary 
the state and the measurements. Such a procedure could 
in principle reveal the presence of any fixed interaction 
Hamiltonian H, since it has been shown that for any 
such interaction there exists a strategy involving only lo- 
cal operations and classical communication that reveals 
the presence of the interaction as signaling (33|. How- 
ever, we do not know of any systematic way for finding 
this strategy if H is unknown, nor do we know how to 
relate in a systematic way the observed signaling to H. 

Finally, by modeling the physical systems, their inter- 
action and the measurement procedure, it is possible to 
estimate the amount of CT. An example of this last ap- 
proach are given below. 
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I = 4 




FIG. 2: Part of the no-signaling polytope. The curved solid 
line separates the post-quantum region (PQR) from the quan- 
tum region (QR) - the set of probabilities that can be realized 
by product measurements on quantum states. The straight 
dashed line represents Tsirelsons bound. The horizontal solid 
line separates QR from the classical or local region (LR). The 
top vertex corresponds to the PR box 32]. Although non- 
signaling, points in PQR cannot be realized by product mea- 
surements, but only by non-product ones. Restricting the 
amount of CT to Xi on ty points below the curved dahsed line 
are (quantumly) realizable. 



C). The same value is also obtained by solving the second 
order relaxation of Eq. ([6]) using the set of observed data 
found in in the Supplementary Information for (22j. 

For the reported degree of CHSH violation / = 2.0732, 
and the above value of the CT, we find that P * < 0.983. 
To establish robustness we note that for as a low a vio- 
lation as I = 2.002 P * < 0.998. This shows that useful 
randomness is extractable from this experiment. 

Conclusion - The analysis of any DI protocol requires 
that we specify the amount of CT between the devices 
(irrespectively of whether it is vanishing or finite) - a re- 
quirement that cannot be fully verified or implemented 
in a DI manner. In this work we have shown that one can 
relax the maxims appearing previous works on DI RG, by 
allowing for a small amount of CT between the quantum 
systems. In this way we can keep most of the advantages 
of the DI approach and at the same time reach data rates 
of practical interest. Finally, we note that our approach 
can be generalized to other DI protocols where the de- 
vices are in the same lab, such as DI tests of genuine 
multi-partite entanglement (Tlj . 



Candidates for real-life implementation - A system 
ideally suited for the implemenation of DI RG will (i) give 
rise to a sufficiently high Bell violation with the detection 
loophole kept closed, (ii) exhibit a negligible amount of 
CT, and (iii) allow for very high data rates. We discuss 
below an experiment based on Josephson phase qubits, 
which meets all of these requirements. Another possibil- 
ity is based on trapped ions, as discussed in Appendix 
B. 

In the CHSH experiment of [22[ two Josephson phase 
qubits, coupled by a radio frequency strip resonator, are 
used. The qubits are located on the same chip, sepa- 
rated by 3.1 mm, and are entangled by successively cou- 
pling them to the strip resonator. Single qubit rotations 
are effected by applying microwaves at the resonance fre- 
quency of the corresponding qubit. Read-out is effected 
by letting the excited state tunnel to an auxiliary state 
macroscopically distinct from both the ground state and 
the excited state. All operations can be carried out on 
time scales significantly shorter than 1 fj,s. (For a recent 
review of Josephson phase qubits experiments see [IBj].) 

The constant coupling between the qubits gives rise 
to some CT. From the analysis of the experimental set 
up performed in [22j and [3J|, it appears that the most 
significant contribution to the CT occurs during the read- 
out: The tunneling of one qubit from the excited state 
to a macroscopically distinct state sometimes forces the 
other qubit to tunnel when in the ground state. This 
allows us to estimate the CT at 0.0030 (see Appendix 
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Appendix A 

We prove here Eq. (0). Eq. ^ can be re-expressed 
as 4P* y (I, 6) > (4 - I) + (2 + 85). The first term on the 
right-hand side is now seen to be a sum of probabilities, 
all of which appear in the CHSH inequality with a minus 
sign: 

4-/= ]T [1 - (-l)«© 6 ©*»] p ablxy 

a, 6, x, y 

= 2 (Pqa\00 + -Pqa|01 + Pga\10 + P aa \ll) , (7) 

a 

where a = a ® 1. Hence, any probability, appearing in 
the CHSH inequality with a negative sign, is smaller or 
equal to 2 — 1/2. 

Consider now the following relation 
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2 + 86 > 2 + 2 ]T [(-if P^ + (-1)* Pfe,^] 

x, v 

= 2 + 2(2P ah | 00 + P a fc| 00 - P a fc|oi + P a fc|io ~ 2P ofc | n — P ab "|n + Pafc|oo ~ Pafc|io + P»&|01 — Pafc|ii) 

> 2 + 2(2P afc | 00 - P a fc| i - 2P aft | n - P a b|n - P a 6|io - Pa6|ii) (8) 

> 2 + 2(2P ab | O0 — P a ft| 01 — P a fc|n — 1 + Pab\U ~ Pab\lo) 
> 2(2P ab | 00 — P ab |oi ~ Pab\U ~ Pab\w) ■ 



Setting b = a and summing 4 — 7 and 2 + 86, we get 

6 — I + 86 > 4P aa |oo + 2 (P aa |oo + Paa|oo + Paa|oi 

+P a a|lo + Paa|ll) , (9) 

and so 

Paa|00 < \-\l + 25. (10) 

Similarly, from 

46 > [(-l) X+V+1 Pa\ X y + ("if P b \ X y] , (11) 

x, y 

it follows that 

P aa \ox< \-\l + 26, (12) 

from 

45 > J2 [(-1)" ^-|*» + (-lf +s/+1 P|„] (13) 
x, y 

it follows that 

Paa|10 < \-\l+16, (14) 

and from 

4 ^ E [E (-!) K+y + c- 1 )^ 1 (Am + nixO" 

(15) 

it follows that 

Paa|ii < \-\l + 28, (16) 

and so any probability appearing in the CHSH inequality 
with a positive sign is smaller or equal to | — ■jl + 26. 
We therefore have that whenever I > 2 (the case I < 2 
being trivial) 

P* y {I, 5) < max{2 - \l, \- \l + 25} = \ \l + 26 

(17) 

for all pairs of inputs x and y. 
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We derive here a rough estimate for the amount of CT 
present in the experiments such as [24]. Vibrationally 
coupled ions in the same trap are one of the most ad- 
vanced quantum information processing systems. The 
system is initialized by preparing the ions in their vibra- 
tional ground state, following which they are entangled 
via the vibrational coupling. Measurements can be real- 
ized on each ion individually: First, to choose the mea- 
surement setting, single qubit gate operations are per- 
formed by addressing the ions individually with focused 
light beams. The state of each ion is then measured in 
the computational basis using fluorescence. The whole 
process takes < 1 ms and the fidelities of the gates and 
measurements are high (~ 99 %). (For a recent review of 
quantum information processing using ion traps see (26[.) 

In these experiments the ions are typically separated 
by ~ 5 /im, resulting in some CT. It seems that the main 
contribution to the CT is due to the single qubit rotations 
performed to select the measurement settings. Indeed, 
the light beams used to address the ions have a width of 
2 /im. As a result, if the state of one ion is rotated by 
9 on the Bloch sphere, the neighbouring ion will be ro- 
tated by e ~ 0.030 (this is the ratio of Rabi frequencies, 
as discussed in |26[). More specifically, with no loss of 
generality we may assume that the ideal entangled state 
shared by the parties is such that the corresponding ideal 
measurements are projectors onto the states \ip a bxy) — 
\a Vsc ) (g> \b Vy ), where \a Vl ) {\b Vy }) denotes a state on the 
Bloch sphere parametrized by 9 = ir/2 and ip = <p x = 
(— if 7r/4 (<p = <p y = (— if 7r/4). As explained above, 
due to the CT, the rotation of one ion by 9 induces a 
rotation of the other by e ~ 0.036*. The actual measure- 
ments therefore consist of projectors onto \^ a bxy (e)) = 
|<We)) ® \K y (e)) with Vx {e) = [(-if + (-lf e ]7r/4 
and <p v {e) = [(-l) v + (-if e] tt/4. 

An upper bound on x is given by the largest eigenvalue 
(up to a sign) out of the set of eigenvalues of the 16 
matrices \£, a bxy (e)) (£abx V (e)| - \4>abxy) (i>abx V \- Since in 
the CHSH experiment tp x , ip y = ±7r/4, we get that x ^ 
0.015. 
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Appendix C 

We derive here the estimate for the amount of CT 
present in the experiment reported in (22[. Denote the 
ground and excited states by |0) and |1), respectively. 
Then, as explained in the main body of the text, the 
probability of obtaining anti-correlated outcomes is at- 
tenuated. Specifically, let pa {pb) be the probability 
that the tunneling of qubit A (B) - i.e. obtaining the 
outcome 1 for the measurement of the state of qubit A 
(B) - forces qubit B (A) to tunnel when in the ground 
state. We can model the presence of the CT as follows: 

IIoOlxi/ = Ho|a5 ® ^k)\y i 
n l|xy = (1 -PB)^0\x , (18) 

^W\xy = (1 - PA) Ililaj ® U, \y , 
^-ll\xy = ^l\x ® Illly + PB^0\x ® Hi | a + PARl\x ® n o | y , 



where using the notation of Appendix B H a \ x = 
\a Vsc ) (a Vx \, etc. To estimate the amount of CT we need 
to find the nearest set of product POVMs. For simplicity, 
we assume them to have the form 

M Q\x = (1 - <H) U Q\x + QA^l\x > 

M oly = (l-q B )Il oly + q B Il lly . (19) 

Even if this is not the optimal choice it will still pro- 
vide an upper bound on %. Setting pa = 0.0059 and 
Pb = 0.0031 (the values reported in the Supplemen- 
tary Information for [Hj]), the largest eigenvalue (up to 
a sign) out of the set of eigenvalues of the 16 matrices 
n a b\ X y ~ M a i x ® AfjUy, after minimization with respect 
to qA and qs, equals ~ 0.0030 and is obtained when 
q A ^ 0.0001 and q B ^ 0.0029. 
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